Anti-DDoS:Anti-DDoS Native 2.0 (Subscription)

Select an instance

Anti-DDoS Native 2.0 (Subscription) provides the following instance types, each available in Insurance mode and Unlimited mode:

• Anti-DDoS Native (SMB): Select this instance if your public IP assets are in the same region, the number of IPs is 30 or fewer, and the business bandwidth does not exceed 1,000 Mbit/s. This edition supports only standard cloud assets and does not allow Advanced EIPs.

• Enterprise: Select this instance if your public IP assets span multiple regions, the number of IPs exceeds 30, or your assets include both IPv4 and IPv6 addresses. This edition supports both standard and enhanced cloud products, with the latter requiring Advanced EIPs.

Business bandwidth selection

Estimate your service traffic and select an appropriate clean bandwidth when you purchase an instance.

The system samples bandwidth at 5-minute intervals for both inbound and outbound traffic. For each sample, the higher of the two values is used as the bandwidth for that point. At the end of the month, the system sorts all sample points in descending order, discards the top 5%, and uses the highest remaining value as the estimated bandwidth (the 95th percentile).

The following figure illustrates how estimated bandwidth is calculated over a 30-day period.

Bandwidth limit

Enhanced cloud assets have the following bandwidth limits based on region. Standard cloud assets do not have these limits:

Bandwidth overage recovery

• Overage alerts and mitigation downgrade: Anti-DDoS Native allows business traffic to temporarily exceed the instance bandwidth. When the cumulative monthly overage duration reaches 1 hour, 9 hours, 18 hours, 27 hours, or 36 hours, the system sends a notification through Message Center the next morning (T+1). When the cumulative overage duration reaches 36 hours, Anti-DDoS Native protection is disabled and only Basic protection remains.

• Three ways to restore Anti-DDoS Native protection: If protection has been disabled, you can restore it using one of the following methods:

  • Method 1: Wait for automatic recovery at 00:00 on the 1st of the next month. No action is required.

  • Method 2: Enable elastic business bandwidth (Anti-DDoS Native 2.0 Enterprise subscription instances only). Protection is restored immediately after enabling. The bandwidth limit increases to 5 times the baseline bandwidth (adding 4 times as elastic bandwidth).

  • Method 3: Upgrade the baseline bandwidth of your instance. Protection is restored immediately after the upgrade.

• Overage accumulation rules after recovery: After restoring protection using method 2 or 3, the overage handling rules for the remainder of the month are as follows:

  • If 36 hours were already accumulated before recovery: If overage occurs again after recovery, you receive an alert the next day (T+1) and protection is disabled again.

  • If less than 36 hours were accumulated before recovery: Overage duration continues to accumulate after recovery. If the total cumulative duration reaches 36 hours for the month, you receive an alert the next day (T+1) and protection is disabled.

Why does the traffic data in Cloud Monitor and other cloud product metrics differ from the Anti-DDoS traffic data?

Traffic metrics displayed in the Anti-DDoS console are typically higher than those shown in Cloud Monitor or other specific cloud product pages.

Example scenario:
When an ECS instance undergoes a DDoS attack that triggers traffic scrubbing, the Anti-DDoS Basic notification may report a trigger threshold of 2.5 Gbit/s. However, a query in Cloud Monitor for the same period might show an inbound bandwidth of only 1.2 Git/s on the EIP associated with the ECS instance.

This discrepancy arises from three main factors:

• Measurement stage (pre-scrubbing vs. post-scrubbing)

  • Anti-DDoS data: Captured before traffic scrubbing. It includes all incoming traffic, comprising both legitimate business traffic and malicious attack traffic.

  • Cloud Monitor data: Captured after traffic scrubbing. It reflects only the legitimate traffic that has been filtered and forwarded to the instance, as attack traffic is discarded during the scrubbing process.

• Monitoring granularity (second-level vs. minute-level)

  • Anti-DDoS: Utilizes second-level granularity to detect attacks, allowing it to capture instantaneous traffic spikes accurately.

  • Cloud Monitor: Typically aggregates EIP traffic data at minute-level intervals. Consequently, instantaneous peaks may be smoothed out in the average, resulting in lower reported values compared to real-time spikes.

• Monitoring location (network boundary vs. forwarding device)

  • Anti-DDoS: Monitors traffic at the boundary between the Internet and the Alibaba Cloud network, recording all raw inbound traffic.

  • Cloud Monitor: Collects data from forwarding devices closer to the instance, recording only the traffic successfully delivered to the resource.